CVE-2026-23058
Description
A flaw was found in the Linux kernel's ems_usb Controller Area Network (CAN) Universal Serial Bus (USB) driver. A local user with access to the CAN network interface can repeatedly trigger open and close cycles, leading to a memory leak. This occurs because completed USB Request Blocks (URBs) are unanchored by the USB core before the completion callback runs, preventing proper cleanup. Over time, this resource exhaustion can lead to a denial of service.
Statement
A memory leak can occur in the ems_usb CAN USB driver because completed RX URBs are unanchored by the USB core before the completion callback runs. The driver anchored URBs only during open and then relied on usb_kill_anchored_urbs during close to free them. Once an URB completes it is no longer in the rx_submitted anchor and it can escape cleanup which leads to leaked URB allocations over repeated activity and open close cycles. For the CVSS the PR is L in the paranoid rating because a user with access to the CAN network interface can often trigger open close or device use through standard networking administration in delegated environments. The issue is not directly network reachable in the IP sense. Impact is denial of service via resource exhaustion over time.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Instability; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
Most memory leaks result in general product reliability problems, but if an attacker can intentionally trigger a memory leak, the attacker might be able to launch a denial of service attack (by crashing or hanging the program) or take advantage of other unexpected program behavior resulting from a low memory condition.
Other
Technical Impact: Reduce Performance
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
